Windows 8.1 Can't Run Group Policy Editor

I am a fairly aggressive Windows 8.1 user. My system started as Windows 7 and was upgraded to Windows 8 and Windows 8.1. Mostly everything works fine, but there are several nagging problems that might mean I need to rebuild by system. I am an advanced user but not a registry wizard (though I am not afraid to edit registry if needed.)

Normally I use a separate administrator account, but these problems are not solved by changing my regular account to administrator.

1. I keep getting a message that Picasaupdater does not have permission to run. Picasa works fine and is set to not update. I have exerted a lot of energy searching for the solution to this but have not found it.

2. I login in with a Microsoft account but cannot save anything to OneDrive. I get a message saying I don't have permission. I don't much care, except that this is a symptom that all is not well. On another computer with the same login, OneDrive works fine.

3. In an attempt to fix 1. and 2., I tried to run gpedit.msc and secpol.msc. They open with a message that "You do not have permission to perform this operation" and cannot do anything.

I do not have similar problems with another computer that came with Windows 8.1. If anyone has any hints let me know.

One thing I have not tried is creating a new user and migrating to that user. Might be easier than rebuilding, though my first choice would be to actually fix the problems.

I could just ignore the problems since most everything works fine.

(Later) Looks like these problems are limited to one account, so now investigating migrating settings from one account to another on the same machine. Still interested in any comments. I could run the Group Policy Editor from my other (local) account. Thanks

Thanks for responding. I can't right click when running secpol.msc using the windows 8 search. But I get a permission error if I do try to run it that way on my main (temporarily administrator) account. Don't get the error with my other local administrator account.

If I locate those files I can run them with or without right clicking and running as administrator. The only reason I want to run the policy (or security) editor is to fix the Picasa and OneDrive problems.

For what it's worth, the OneDrive folder is called "SkyDrive" on my problematic account and "OneDrive" on my local administrator account.

I might explore running the security policy editor the way I described above, but I increasingly feel my main account is corrupted somehow and I should migrate to a new account on the same computer, though that doesn't appear to be trivial to do. I may still give the policy editor tactic a shot.

My comment about skydrive and onedrive is probably bogus, looks like they are in some sense links to each other. I don't recall using the upgrade assistant, but by and large, my migration from Windows 7 to 8 to 8.1 has been fairly painless. But I do understand that Windows systems gain a certain amount of entropy as time goes on, more so after as many upgrades I have done, which is a little unusual for me. Usually I don't upgrade a particular computer to a complete new Windows, but go to the new version when I build a new computer.

I think I have "solved" my problem, although since I have no idea why this worked, it is a little unsatisfying. I downloaded the latest Windows Repair (All in One) v2.7.5 from Tweaking.com. It does a boatload of fixes and leaves excellent logs. I used the default settings. I have courage to try something like this because I have an absurdly aggressive backup scheme.

Now:

1. I can run gpedit.msc and secpol.msc as I am supposed to using Windows 8.1 search. This was definitely fixed by something tweaking.com utility did.

2. I can now save to OneDrive, albeit I need administrator permission. Not clear if this is "fixed" or I just didn't notice the need for admin before. I use Office 2010, and it just refused to save to the (now default) OneDrive location. But when I start Word as administrator, all is well. And outside of Word, I can copy files to OneDrive. To be honest I am a heavy dropbox user and only noticed the problem because I changed from a local to a Microsoft account, and OneDrive became the Word default saving location. I have virtually no experience with OneDrive.

3. (knock on wood) I have yet to see the "PicasaUpdater_xxx.exe Your system administrator has blocked this program". Too early to declare victory, but I am hopeful because I have rebooted a few times and normally would have seen this message by now. If this is indeed fixed, tweaking.com gets the credit; I did nothing else to fix it. I guess if I had more scientific curiosity and too much free time I could figure out which of the 36 things Windows Repair (All in One) did solved the problem, but it's not going to happen. (later) Nope, the picasaupdater problem is still there. Well, two out of three fixes is not too bad

Picasa is still set to not update. Picasa does not show up in Start Menu folder.

Picasaupdater gets recreated over and over. If you look earlier in this thread, picasaupdater is in <user directory>\AppData\Local\Temp\

The last message I got was for PicasaUpdater_6cec.exe. The part at the end changes, and deleting these executables does not cure the problem. I believe they are created by a general google updater program.

This thread discusses a nearly identical problem (except this user is trying to update, and I am experiencing an uncontrollable auto updater):

I am game to try the policy editor. One of the comments in the above Google product forum thread is that a virus-prevention policy prevents programs from running in <user directory>\AppData\Local\Temp\. If that is right, I might be able to "cure" the problem at the expense of possibly making my computer less safe.

Occurs to me I could compare policies on an new Windows 8.1 laptop that does not exhibit the problem with my older workhorse computer.

Thanks. I couldn't find the setting in the policy editor reference in your link, so I edited the registry after making careful notes as to what I did. I am afraid, though, that all Google updates are disabled, we shall see. There is nothing picasa-specific about the registry fix.

Well, there's %localAppData%\*\*.exe which expands to C:\Users\xxxxx\AppData\Local\*\*.exe which should work(?). The choices are disallowed, basic user, and unrestricted. At the moment I have it set at unrestricted. Supposedly this would let picasaupdater run. If it works I'll add a more specific rule.

I set the registry to disable Google update as you suggested earlier in an old link, but decided against it and later undid it. In any case I should try one thing at a time. I don't really mind if picasaupdater runs if I don't get bothered by a notification. I'm not sure I want to turn off Google updates generally. Annoyingly, Picasa hasn't HAD an actual update for a long time.

By the way, as you indirectly warned, the older behavior has returned that was briefly "fixed" by the tweaking.com program. I can no longer run secpol.msc via the windows search, I have to find the executable and run that directly. Seems to work, but a sign something is wrong.

I did add Google administrative template to the local policy editor. A lot of fine grained control possible, but didn't see Picasa.

This has long since turned into a quest for deeper knowledge on my part more than fixing a serious problem. But who knows, it may help someone!

>>Is not %localAppData% one of the places where we don't want anything to run from??

Exactly the point! That's why I was getting an annoying notification that picasaupdater was blocked by the administrator, because it was trying to run from %localAppData%/temp. I tried changing the security policy to allow %localAppData%/* and %localAppData%/*/* but it didn't help. Had that worked, I could have added a rule specifically limited to picasaupdater to prevent exposing myself top too much danger.

1. Early on in this thread I was asked if I could right click on secpol.msc with Windows search, and run as administrator. I said I couldn't. More recently I wondered if I had confused secpol.msc with gpedit.msc when I gave that answer. The former I can run as administrator by right clicking, the later does not give that option (or any option) when I right click. (I can still run gpedit.msc by locating it in windows explorer in which case right click works). Reminder that my main account does not have administrator privileges.

2. Since June's second Tuesday Microsoft updates, I have not seen the Picasaupdater problem. To be extra careful, I undid the changes I made using secpol.msc

So ... I have not seen the picasaupdater problem since patch Tuesday (knock on wood...). I can run secpol.msc by locating with windows search, right clicking, and running as administrator. I cannot do the same with gpedit.msc because there is no right click menu when using windows search, but I can run it if I locate the file in windows explorer and right click.

Some of my experiments earlier indicated I could probably fix all these problems by simply migrating everything to a new user, which is much easier that doing a fresh install. But I am not going to test this hypothesis since pretty much everything works well now.

What I use is a shortcut to MMC. Type mmc at the run prompt. Under file select add remove snapins. When done selecting snapins, save configuration when exiting. Create a quicklaunch shortcut to the saved configuration, (likely at "C:\Documents and Settings\yourname\Start Menu\Programs\Administrative Tools\BasicConsole.msc")
You can now use 'runas' by right clicking the shortcut.